Your privacy, plainly explained.

1. Introduction

This Privacy Policy explains how TradeSoft ("we", "us", or "our") collects, uses, stores, and shares your personal information when you use the TradeSoft mobile application ("App") and related services (collectively, "the Service").

By using TradeSoft, you agree to the collection and use of your information as described in this Policy. If you do not agree, please do not use the App.

We may update this Policy from time to time. We will notify you of material changes via in-app notification. Continued use of the App after changes are published constitutes acceptance of the updated Policy.

For questions or requests relating to this Policy, contact us at legal@tradesoft.app.

2. Who We Are

TradeSoft is operated by a sole trader based in New Zealand. We are subject to the New Zealand Privacy Act 2020 ("Privacy Act"). Where we have users in other jurisdictions in the future, we will comply with applicable local privacy laws.

3. Information We Collect

3.1 Information You Provide Directly

3.2 Information Collected Automatically

When you use the App, we and our service providers may collect:

• Device information — device type, operating system, and version
• App usage data — screens viewed, features used, session duration, and interactions within the App
• Approximate location — used at first launch to verify you are in New Zealand and to pre-populate your region and town. We do not continuously track your location.
• Crash and error data — diagnostic information generated when the App encounters an error
• Push notification tokens — to deliver notifications to your device

3.3 Information from Third Parties

We receive limited information from the following third-party services when you use them in connection with TradeSoft:

• Supabase — our backend infrastructure provider. Authentication events, database records, and file storage are processed by Supabase.
• RevenueCat — processes and verifies in-app purchases made through the Apple App Store or Google Play Store. We receive purchase confirmation and credit balance information. We do not receive or store your payment card details.
• Twilio (via Supabase Phone Auth) — if you choose to verify your phone number, Twilio sends and verifies the SMS code. Your phone number is shared with Twilio for this purpose only.
• PostHog — we use PostHog for product analytics and crash reporting. PostHog collects anonymised usage data and error logs to help us understand how the App is used and to identify and fix issues. PostHog may set identifiers to distinguish users at an aggregate level. No personally identifiable information is intentionally sent to PostHog.

4. How We Use Your Information

We use the information we collect to:

5. Information Shared with Other Users

TradeSoft is a community marketplace. The following information is visible to other logged-in users of the App:

• Your display name (or full name if no display name is set)
• Your profile photo (if uploaded)
• Your home region
• Your last online status (time-relative format)
• Your aggregate feedback score and feedback history
• Your active listings
• Your phone verified badge (if applicable)
• Content you post in public Q&A threads

The following is not publicly visible:

• Your email address
• Your phone number (unless you choose to display it on a listing)
• Your full name (if a display name is set)
• Your exact town (used internally for location features — region is shown publicly)

When you complete a trade and leave feedback, the listing title is stored as a snapshot. The listing itself is not linked from your feedback history, to protect the privacy of deleted listings.

6. Information Shared with Third Parties

We do not sell your personal information. We share your information with third parties only in the following circumstances:

• Service providers — Supabase (infrastructure), RevenueCat (purchase verification), Twilio via Supabase (phone verification), and PostHog (analytics and crash reporting), as described in Section 3.3. These providers process data on our behalf and are contractually required to protect it.
• Apple / Google — in-app purchases are processed by the App Store or Google Play. Their privacy policies govern how they handle your payment and purchase information.
• Legal obligations — we may disclose your information if required to do so by law, court order, or government authority, or where we reasonably believe disclosure is necessary to protect the safety of any person or to prevent fraud or illegal activity.
• Business transfer — in the event of a sale, merger, or transfer of TradeSoft's business, your information may be transferred as part of that transaction. We will notify you via in-app notification if this occurs.

7. Push Notifications

We send two types of push notifications:

Transactional notifications — directly related to your use of the App, including:

• New private messages
• Responses to your public Q&A questions
• Listing expiry reminders
• Trade completion prompts
• Feedback requests

Promotional notifications — updates about TradeSoft features, community news, or special offers.

You can manage notification preferences at any time in the App under Settings → Notifications. You may also revoke notification permissions at the device level via your iOS or Android settings. Revoking device-level permission will stop all notifications, including transactional ones.

8. Location Data

We request access to your device location in the following circumstances:

• First launch / onboarding — to verify that you are located within New Zealand, and to pre-populate your home region and closest town during account setup
• Listing creation — to pre-populate the region and town fields for a new listing

We do not continuously track or log your location. Location data is used at the point of collection to determine your region and nearest town from our fixed seeded list — it is not stored as raw coordinates associated with your account.

If you deny location permissions, region and town fields remain available for manual selection.

9. Image Storage

Photos you upload (profile photos and listing images) are stored in Supabase Storage, scoped to your user ID. Your profile photo is stored at a path unique to your account and is overwritten when you update it. Listing photos are stored per listing and are deleted from storage when a listing is permanently deleted.

Images uploaded to TradeSoft are accessible to other logged-in users of the App as part of the normal operation of the marketplace.

10. Data Retention

When you delete your account, your personal data is scheduled for deletion within 90 days. During this period, your account and listings are removed from public view immediately. We retain data for this period to assist with fraud detection, dispute resolution, and legal compliance. Purchase records are retained longer where required by law.

11. Security

We take reasonable steps to protect your personal information from unauthorised access, loss, misuse, or alteration, including:

• Passwords are hashed and never stored in plain text
• Data in transit is encrypted using TLS
• Access to backend systems is restricted and role-scoped via Supabase Row Level Security (RLS) policies
• Storage paths are scoped to individual user IDs

No method of transmission or storage is completely secure. We cannot guarantee absolute security and encourage you to use a strong, unique password and keep your account credentials confidential.

12. Children's Privacy

TradeSoft is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If you believe a child has created an account, please contact us at legal@tradesoft.app and we will promptly delete the account and associated data.

13. Your Privacy Rights

Under the New Zealand Privacy Act 2020, you have the right to:

• Access the personal information we hold about you
• Correct any information that is inaccurate or out of date
• Request deletion of your account and associated personal data (subject to the retention periods in Section 10)
• Withdraw consent for optional data uses (e.g. promotional notifications) at any time

To exercise any of these rights, contact us at legal@tradesoft.app. We will respond within 20 working days, as required by the Privacy Act.

If you are unsatisfied with our response, you have the right to make a complaint to the Office of the Privacy Commissioner at www.privacy.org.nz.

14. International Data Transfers

TradeSoft uses service providers that may store or process your data outside New Zealand, including:

• Supabase — infrastructure hosted on AWS (region may vary)
• PostHog — data may be processed in the United States or European Union
• Twilio — SMS processing infrastructure based in the United States
• RevenueCat — based in the United States

Where data is transferred internationally, we rely on our service providers' own privacy and security commitments, and we take reasonable steps to ensure your data is handled in a manner consistent with the New Zealand Privacy Act 2020.

15. Third-Party Links & Services

Listings on TradeSoft may include YouTube links provided by sellers. Tapping these links will open a third-party application or browser. TradeSoft is not responsible for the privacy practices of third-party services. We encourage you to review their privacy policies before engaging with them.

User profiles may display links to Facebook, Instagram, YouTube, and TikTok accounts. These are provided by users and are subject to the privacy policies of those platforms.

16. Contact

For any questions, requests, or concerns about this Privacy Policy or how we handle your personal information:

Email: legal@tradesoft.app

We aim to respond to all privacy-related enquiries within 20 working days.